[
https://issues.apache.org/jira/browse/SENTRY-486?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14198712#comment-14198712
]
Tuong Truong commented on SENTRY-486:
-------------------------------------
Hi Mike,
While the goal is the same as you stated, the two approaches are at different
level. If my understanding of the Hadopo credentialProvider work is correct,
it is providing a secured password storage facility. As such integration with
it requires moving the password out of the configuration files. While this is
a good thing, it provides little room for password management. Also, if a
credential provider is not setup, you ends up where this particular JIRA begins
unless you are willing to prereq a credential provider.
This JIRA's solution attempts to solve the same issue by providing a mean for
password management starting where the password is currently acquired, and
allows for customized management of the password. This approach is fairly
flexible in term of how the password is materialized. For instance, we can
easily add an ICryptor implementation to hook to the Hadoop Crendential
Provider. Furthermore, this approach can enable users to implement some sort
of password generation algorithm to automanage password expiration/rotation,
node/user specific password, etc...
Let's keep this dialog going. As I said, I have not dig into the
CredentialProvider to see how flexible it is, and would appreciate your input
once you got a chance to look into it more- I will look into once I get some
breathing room. I hope I was able to clarify what I am thinking regarding
password management vs password storage.
> Add database password obfuscation support for sentry-site.xml
> -------------------------------------------------------------
>
> Key: SENTRY-486
> URL: https://issues.apache.org/jira/browse/SENTRY-486
> Project: Sentry
> Issue Type: Improvement
> Affects Versions: 1.4.0
> Reporter: Tuong Truong
> Assignee: Tuong Truong
> Labels: security
> Attachments: SENTRY-486-0.patch
>
> Original Estimate: 16h
> Remaining Estimate: 16h
>
> Currently, the db store database password is in plain-text in the
> sentry-site.xml file. This is a security issue. We need to be able to
> support encrypted password in the config file.
> We plan to add a couple of property into the sentry-site.xml file. So in
> addition to the existing:
> <property>
> <name>sentry.store.jdbc.user</name>
> <value>sentry</value>
> </property>
> <property>
> <name>sentry.store.jdbc.password</name>
> <value>test</value>
> </property>
> we propose to add:
> <property>
> <name>sentry.store.jdbc.password.encrypted</name>
> <value>true</value> // This indicate to Sentry that the password is
> encrypted - Default = false
> </property>
> <property>
> <name>sentry.store.jdbc.password.cryptor</name>
> <value>org.test.decryptor</value> // This is the class needed to use to
> decrypt the password
> </property>
> Sentry will invoke the decrypt() method on org.test.decryptor to obtain the
> decrypted password to configure DataNucleus.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
